CVE-2026-55962
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Vulnerability in TLS 1.3 post-handshake authentication (PHA) where a server could accept a client's Finished message without requiring a certificate and CertificateVerify. The issue was due to incorrectly applying the empty certificate exemption intended only for the initial handshake, also during an outstanding post-handshake CertificateRequest.
Risk Assessment
The risk is that a server may accept a connection from a client without the required certificate, potentially leading to unauthorized access or authentication bypass in environments requiring strong client authentication.
Recommendation
It is recommended to update the wolfSSL library to a version where the certificate check scope is fixed to only the initial handshake. For servers using post-handshake authentication (PHA), enable the FAIL_IF_NO_PEER_CERT verification mode.
Related vulnerabilities
- CVE-2026-87855Critical
The JTL-Connector plugin for WooCommerce up to version 2.4.3 is vulnerable to arbitrary file upload via the saveImage() function. This is due to accepting an empty jtlauth parameter as valid credentials and insufficient file type validation in handleImagePush(). This allows unauthenticated attackers to upload executable files, leading to remote code execution.
- CVE-2026-104800Critical
The AGE-GATE plugin for WordPress up to version 1.0 is vulnerable to remote code execution via the 'width' and 'height' parameters. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters into generated PHP source. This allows unauthenticated attackers to execute code on the server.
- CVE-2026-97668Critical
The Abandoned Cart Pro plugin for WooCommerce up to version 10.8.0 is vulnerable to SQL injection via the guest cart persistent meta_value. This is due to insufficient escaping and lack of prepared statements in the update_guest_persistent_cart() function. The abandoned_cart_info value is concatenated directly into an UPDATE statement, allowing unauthenticated attackers to append additional SQL, potentially leading to data extraction and privilege escalation.
- CVE-2026-97657Critical
The Abandoned Cart Pro plugin for WooCommerce up to version 10.8.0 is vulnerable to authentication bypass via malleable encryption and bypassable HMAC. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens and a conditional HMAC check that can be bypassed by omitting the wcap_nonce parameter. This allows unauthenticated attackers with a single legitimate link to forge ciphertext and take over any user's account, including administrators.
- CVE-2026-110447Critical
Collabora Online Built-in CODE Server before version 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, exploited in the wild in September and October 2026. This is an OS command injection in proxy.php when the CODE server isn't running. The vulnerability is not present in standalone Collabora Online servers.
- CVE-2026-110002Critical
The Snazzy Social Media Feed plugin for WordPress up to version 2.5 is vulnerable to arbitrary file upload via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter. This allows authenticated attackers with subscriber-level access and above to upload executable files, leading to remote code execution.
- CVE-2026-93388Critical
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce up to version 2.9.1 is vulnerable to unauthenticated arbitrary file upload leading to remote code execution. The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers, and its Google Drive branch rebuilds the destination filename from the raw gapi[name] parameter, bypassing the allow-list, and writes the fetched bytes to a web-accessible directory. This allows unauthenticated attackers to write a .php file to an executable location and execute arbitrary code on the server.
- CVE-2026-92097Critical
The Click to Chat for WhatsApp plugin for WordPress up to version 4.44 is vulnerable to arbitrary shortcode execution. This is due to the greetings_dialog() function building the {url} placeholder from a filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted content to do_shortcode() without stripping shortcode delimiters. This allows unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin.
- CVE-2026-110392Critical
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows OS Command Injection.
- CVE-2026-97381Critical
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.
Original NVD description (English source)
TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certificate was only intended for the initial handshake, but it was also being applied while a post-handshake CertificateRequest was still outstanding. The check is now scoped to the initial handshake only: on the server, once a post-handshake CertificateRequest has been sent (certReqCtx is set), a peer certificate and a valid CertificateVerify are required again before the Finished is accepted, with empty-certificate handling following the configured verify mode (FAIL_IF_NO_PEER_CERT) just as during first-handshake client authentication. Only affects TLS 1.3 servers built with post-handshake authentication support (WOLFSSL_POST_HANDSHAKE_AUTH / --enable-postauth, included in --enable-all) that enable WOLFSSL_VERIFY_POST_HANDSHAKE and request a client certificate after the handshake via wolfSSL_request_certificate(). Clients, and servers that do not use post-handshake authentication, are unaffected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS